ClawHub
Back to skill

Security audit

X

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently connects an agent to X's hosted MCP server with disclosed OAuth token storage and user-confirmed write capability.

Install only if you intend to let the agent access your X account through X's hosted MCP server. Treat write access seriously: confirm exact post text or account actions before use, and use X Connected Apps controls for definitive revocation if you disconnect later.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description says this skill is for interacting with X content and accounts through X's hosted MCP server. The supplied code does not read X posts, inspect users, search X, or perform any X write action. Instead, it initializes OAuth state for an MCP server by extracting access tokens, refresh tokens, client ID/secret, and expiry metadata from environment variables, constructing a JSON payload, and storing it in a mcporter vault. That is a materially different primary purpose and an undeclared sensitive capability involving credential handling and storage. While this may support access to some MCP server, it is not itself an X research/inspection/write implementation.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md
not MCP-native OAuth; X's hosted MCP endpoint does not advertise MCP OAuth
discovery or dynamic client registration.

`scripts/setup.sh` seeds mcporter's per-user OAuth vault with the access token,
refresh token, client ID, and client secret provided by the runtime sync path.
mcporter injects the bearer token into hosted requests and refreshes an expired
access token through `https://api.x.com/2/oauth2/token`. Setup must run only with

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
not MCP-native OAuth; X's hosted MCP endpoint does not advertise MCP OAuth
discovery or dynamic client registration.

`scripts/setup.sh` seeds mcporter's per-user OAuth vault with the access token,
refresh token, client ID, and client secret provided by the runtime sync path.
mcporter injects the bearer token into hosted requests and refreshes an expired
access token through `https://api.x.com/2/oauth2/token`. Setup must run only with

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
"imports": [],
  "mcpServers": {
    "maverick-x": {
      "baseUrl": "https://api.x.com/mcp",
      "transport": "http",
      "auth": "refreshable_bearer",
      "refresh": {

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
"imports": [],
  "mcpServers": {
    "maverick-x": {
      "baseUrl": "https://api.x.com/mcp",
      "transport": "http",
      "auth": "refreshable_bearer",
      "refresh": {

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · mcporter.json (reported line 5)May include surrounding context.

json
"imports": [],
  "mcpServers": {
    "maverick-x": {
      "baseUrl": "https://api.x.com/mcp",
      "transport": "http",
      "auth": "refreshable_bearer",
      "refresh": {

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · mcporter.json (reported line 9)May include surrounding context.

json
"imports": [],
  "mcpServers": {
    "maverick-x": {
      "baseUrl": "https://api.x.com/mcp",
      "transport": "http",
      "auth": "refreshable_bearer",
      "refresh": {

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description says X writes are only for user-confirmed actions, but the configured OAuth scope includes tweet.write, which grants general posting capability once authorized. This creates a privilege mismatch: if the agent or downstream MCP actions are misused, compromised, or insufficiently gated, it could post on the user's behalf beyond the narrowly described workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The offline.access scope enables long-lived refresh capability that persists beyond the immediate session, which is broader than necessary for basic research or account inspection use cases. If refresh tokens are exposed or the skill is over-permissioned, this increases the duration and persistence of account access, expanding the blast radius of compromise.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.